dam failure - ceae.colorado.educeae.colorado.edu/~amadei/cven3698/pdf/damfailure.pdf · st. francis...

August 28, 2002 4:50 PM DRAFT Dam Failure

Dam Failure by

John T. Christian1 and Gregory B. Baecher2 [September 9, 1999 DRAFT]

Dams are important. Neither New York, Boston, San Francisco, nor Los Angeles, could function without the fresh water stored in their reservoirs, and many of our electric systems sup-ply their base loads from hydro-electric power. Mainstream dams on the Missouri and Missis-sippi protect the great inland valley against the ravages of floods and control navigation waters for the fleets that ply our inland waterways. But dams are also controversial. In recent years en-vironmentalists have raised serious questions about the ecological consequences of dam building. Dams have become—to some—the poster children for bad environmental stewardship. Ameri-can Rivers Network, Friends of the Earth, and other environmental organizations vociferously protest new dam projects. A growing movement has even targeted decommissioning of dams,

Table 1 New dam construction Country Dams in construction 1995China 311 Turkey 190 Japan 140 Republic of Korea 125 India 76 USA 76 Spain 55 Romania 53 Italy 39 Tunisia 37 Algeria 28 Iran 24 Thailand 17 Greece 14 France 12 Brazil 12

that is, removal, as its goal. On Friday, July 2, 1999, for the first time in US history, a govern-ment-ordered demolition crew began tearing down a dam, Edwards Dam on the Kennebec River, Maine, against the owner’s wishes. The Federal Energy Regulatory Commission, after a decade of bitter dispute, refused to renew the dam’s license. Yet, as problems of groundwater pollution and drawdown demonstrate, the alternatives to dams are not always benign, and contrary to popular belief, construction of new dams is actually increasing in the world at large as well as in

1 Consulting Engineer, Waban, Massachusetts 2 Chairman, Department of Civil and Environmental Engineering, University of Maryland

Why Things Fall Apart: 1 of 27 DRAFT DO NOT CITE A systematic view of failure Baecher and Christian, Eds.


the United States. The 1190 dams over 15 meters high under construction in 1991 rose to 1242 by late in the decade, and the number continues to increase. Most dams are designed conserva-tively, built carefully, and maintained meticulously. The care and devotion of the staff at an op-erating dam impress even the casual visitor. Failures are rare. But sometimes things go awry.

St. Francis Dam

In 1928 the Saint Francis Dam was the latest addition to the complex of dams and aque-ducts that brought water to the growing city of Los Angeles. The entire project was, depending on one’s point of view, either a daring and farsighted undertaking that made the present city of Los Angeles possible or an unscrupulous and underhanded robbery of valuable water resources. The best known statement of the latter position is Roman Polanski’s film Chinatown. The dam itself was built between 1923 and 1926. It was a concrete gravity arch; the load of the im-pounded water was resisted both by the weight of the concrete structure and by the horizontal arching action that transferred load to the abutments. Its maximum height was 195 feet, and, when the reservoir filled to capacity, the depth of the water behind the dam directly over the original creek bed would be nearly 180 feet. On the morning of March 12, 1928, a cool, rainy day at the end of California’s wet season, it had filled for the first time.

St. Francis Dam at full pool

The seepage at the bottom of the right end of the dam that had been of growing concern to Tony Harnischfeger, Assistant Damkeeper for the LA Department of Water and Power, con-tinued to get worse. More troubling, the water was muddy. To the engineer, muddy water means erosion somewhere and probably from deep in the abutment.



Late in the afternoon, William Mulholland, the driven head of DWP, and his Chief Engi-neer, Harvey Van Norman, drove the miles of dirt road up San Francisquito canyon to inspect the dam. Ironically, a much later reservoir in San Fernando valley would be named for Van Nor-man, and its dam, too, would fail in 1971, during an earthquake. Harnischfeger was becoming increasingly concerned and had urged Mulholland to inspect the dam. The day was wet; the ground was wet. Muddy water seeped out of a nearby construction site and down the canyon slopes. Mulholland decided the seepage coming from the dam was not of concern. Convinced that the latest dam in the Los Angeles water plan, a dam he himself had helped design, was in no danger, Mulholland and Van Norman returned back down the canyon.

At 11:00 p.m., a caretaker was seen walking on the crest of the dam. Just before 11:47, Ace Hopewell, the person last to see the dam intact, saw a light at the toe, which he took to be Tony Harnischfeger, inspecting the seepage. Mulholland's visit had not relieved Harnischfeger's worry. At 11:57 p.m., lights in LA browned out momentarily, and a minute later, a Southern California Edison transmission line across San Francisquito canyon went out of service

At about midnight of March 12 to 13, the dam had failed catastrophically. So rapid was the failure and so devastating the damage caused by the rushing waters that the details of the failure and the mechanisms that caused it remain controversial to this day. As it was filled to ca-pacity, there were 38,000 acre-feet (12.4 billion gallons) of water in the reservoir. This water roared down the canyon of the San Francisquito River into the Santa Clara River and reached the Pacific Ocean near Ventura over four hours later. The initial height of the wave must have been nearly 180 feet, and, at a power-house about a half-mile downstream of the dam, the wave height was measured as 110 feet.

St. Francis Dam after failure, looking downstream. Concrete monolith at center was all that remained of the dam.

The water devastated the area downstream. Houses, roads, railroads, and bridges were swept away. About 450 people were killed; the exact number has never been established. Har-nischfeger’s body was never found. The entire dam-building program of the city of Los Angeles



was affected; projects were revised or stopped; existing dams were studied and in some cases modified; California developed new regulations to govern the design and construction of dams; professional reputations were destroyed. Mulholland publicly accepted blame, and was a broken man for the remaining seven years of his life. Technical lessons also followed from the failure, but the exact cause of the failure is still controversial. Both of us remember well that the St. Francis Dam failure featured prominently in the geology courses we took as students, even if some of the lessons drawn may not conform to the results of subsequent studies. We will exam-ine the technical and institutional issues surrounding this disaster later, but it remains “the great-est American civil engineering failure of the twentieth century” (Rogers 1992).

Vaiont Dam and Reservoir

Vaiont Dam was, at 265 meters (868 feet), the third highest dam in the world when it was completed in 1960. Built in a narrow valley of the Vaiont River, a tributary of the Piave River in the Italian Tyrol north of Venice, it provided hydro-electric power to the Italian electric grid. It was a thin concrete arch designed to resist the pressure of over 250 m (825 ft) of water im-pounded behind the dam by transferring the load directly to the two abutments. And it was ele-gant. Taken in proportion, the concrete was as thin as an egg shell at the top, just 3.4 meters (11.2 feet) wide, and the structural principle behind the design was the same as that of an egg shell. The dam was doubly curved, horizontally and vertically. All the pressure of the water be-hind the concrete shell was transferred through the dam into the hard rock valley walls.

The technology of dam design and construction had improved in the preceding decades, in no small part because of lessons learned from failures. Engineers came to appreciate the im-portance of the integrity of the abutments, careful control of construction activities, and geologi-cal investigations. They also had much greater confidence in their ability to calculate the behav-ior of thin concrete arches and to build them according to specifications.

The failure of Malpasset Dam, a high thin concrete arch near the French Riviera, in 1959 had alerted dam designers to the dangers posed by planes of weakness in the abutments. Great care was taken at Vaiont to ensure that the abutments would withstand whatever loads were placed on them – care that included extensive geologic investigations. During those investiga-tions a question arose about the stability of the slopes on the south or left side of the reservoir to be impounded by the dam. (Dam engineers define left and right as though they were looking downstream.) Prof. Giorgio Dal Piaz, one of the foremost experts on the Dolomite Alps, ex-pressed confidence in the stability of the slope, but Prof. Semenza, a young geologist, was skep-tical. Although Semenza’s father was the chief designer of the dam, the owners chose age and experience over youth and enthusiasm. The dam was built as planned, but concerns about the stability of the slope led to further investigations and monitoring of its behavior as the level of water in the reservoir was raised. Indeed, forty-five engineers, technicians, and workers were at the site monitoring the slope, living in a hostel high above the dam—57.5 meters (187 feet) above the crest—on the right abutment.



Landslide and area of flooding downstream of Vaiont Dam

Vaiont reservoir after slide, looking downstream. Flat rock sur-

face to the upper left is the sliding plane, approximately 2 km along the reservoir slope.

Movement of the southern (left hand) slope was observed in the first few months of op-eration. Various combinations of remedial measures, control of the water level, and observations were employed to follow and understand the mechanics of the movement. On November 4, 1960, the first, and by later comparison small, slide occurred. Cracking above the scarp of this first slide slowly propagated to encircle an enormous mass of earth. The lake level was lowered,



and a large network of monitoring stations was installed. Once in a while the mass would move suddenly, but usually it moved slowly and continuously, averaging about 10 millimeters (0.4 inches) a week. During this period both Dal Piaz and the elder Semenza died of natural causes. Finally, in September 1963, with the reservoir nearly full and the slope moving alarmingly, the operators started to lower the water level rapidly. At 10:39 p.m. on October 9, 1963, the left slope of the embankment slid into the reservoir. The sliding mass measured about 1.6 km by 1.8 km (about 1 sq. mile) and was as much as 250 m (825 ft.) thick. It has been estimated that it was traveling 20 to 30 meters per second (40 to 60 mph) when it hit the water. The effect was like throwing a large stone into a bathtub. The water splashed up the sides of the reservoir and over the top of the dam. The wave went 100 meters (330 feet) over the top of the dam. This is ap-proximately the depth of the English Channel over the channel tunnel. Over 2000 people down-stream were killed by the rushing water. The hostel on the right abutment disappeared, taking with it all the men housed there and any first-hand observers. Economic damage was appalling.

The village of Casso lies 260 meters (850 feet) above the lake on the right slope. Jansen (1980) describes the report of a resident who was “awakened in his second-story room by the roar of moving rocks. He was not alarmed since surficial sliding occurred fre-quently. The sound continued. Then about 10:40 p.m., an air blast hit the building, break-ing the windows. Soon the roof was lifted and water and rocks came into the room. He had scrambled to the door when the roof fell onto his bed. The wind abruptly subsided.” After-ward, the valley was silent.

The Vaiont river enters the Piave river at a perpendicular angle about 1.6 km (1 mile) downstream from the dam Directly across the Piave was the village of Longarone with 2600 inhabitants. Witnesses reported earth tremors, a wind so strong it broke windows, and then a 70 meter (230 foot) wall of water. The wall erased Longarone from the banks of the river and turned, flowing both up and down the Piave, leveling all it its path.

The dam itself did not fail, but it now retains the slide debris instead of water. It is, perhaps, the world’s largest retaining wall. It was abandoned as a total loss by the electric

utility that built it. Following the slide, many countries revised their regulations governing res-

What is a dam?

Webster's says, a dam is …

“a barrier built across a waterway to control the flow or raise the level of the water.”

The Federal Guidelines for Dam Safety says, …

“Any artificial barrier, including appurtent works, which impounds or diverts water, and which (1) is 25 feet or more in height from the natural bed of the stream or watercourse measured at the downstream toe of the barrier or from the lowest elevation of the outside limit of the barrier if it is not across a stream channel or watercourse, to the maximum wa-ter storage elevation or (2) has an impounding capacity at maximum water storage elevation of 50 acre feet or more. These guidelines do not apply to any such barrier which is not in excess of 6 feet in height regardless of storage capacity, or which has storage capacity at maximum water storage elevation not in ex-cess of 15 acre-feet regardless of height. This lower size limitation should be waived if there is potentially significant downstream hazard.”



ervoir slopes. Geologists and engineers published studies of the slide in learned journals, but there was not a satisfactory and generally accepted explanation of why the slide had occurred when and where it did. In the 1980s a Canadian utility, faced with construction of a reservoir in possibly similar circumstances, retained Hendron and Patton (Hendron and Patton 1985) to re-view the Vaiont case. They managed to make sense of the data, and we present their explanation later.

Types of dams and why they are chosen

The central reason for a dam is to plug a stream and impound water in a reservoir. (Actually, there are exceptions – we have worked on dams that retain reservoirs of fuel oil – but almost all dams hold water.) Many types of dams will serve the purpose, the choice depending on the local geology and geography, the local materials, the construction skills and equipment available, the way the dam will be operated, the experience of the owners and designers, timing, economics, and other factors. Deciding what type of dam to build is a lot like choosing what type of car to buy; anything with four wheels, an internal combustion engine, and other customary features will provide transportation, but there are great differences among sport cars, pickup trucks, sedans, sport utility vehicles, and limousines. Each type of car is suited to some uses and quite inappro-priate for others. The same is true of dams.

Folsom Dam on the American River, California, a concrete grav-ity dam, and Grand Coulee on the Columbia River, Washington

state.

The biggest distinction is between concrete dams and embankment dams. Concrete dams are complex structures made of reinforced concrete, steel, and other structural materials. Em-bankment dams are also complex structures, but composed of intricately interwoven sections of earth or crushed rock configured so that some sections provide strength while others resist water percolation. So basic is the divide between the two types of dams that in most dam-building or-



ganizations the concrete dam staff and the embankment dam staff are in different parts of the or-ganization, maybe in separate buildings. The staffs may have different educational backgrounds, too. Concrete designers tend to be structural engineers; embankment designers tend to be geo-technical engineers and engineering geologists. The heroic dams one first thinks of—Hoover on the Colorado or Grand Coulee on the Columbia—are all massive concrete dams, but since World War II, most dams built in the US have been embankments. The ten largest dams in the world, none of which is in the US, are all embankments. Embankment dams are cheaper, but also more forgiving of imperfect site conditions. In a surprising sort of way, they are also more modern than concrete dams. The engineering theory of embankment dams awaited the development of the discipline of geotechnical engineering in the years straddling WWII; without it, large, safe embankment dams were not possible.

Itaipu Dam, a concrete buttress dam, and the world’s largest hy-

droelectric facility, on the Rio Parana, between Paraguay and Brazil.

There are three broad categories of concrete dams: gravity, buttress, and arch. A gravity dam is essentially a block of concrete that relies on its weight to withstand the forces of the im-pounded water, though, in practice, a gravity dam is a complicated structure with various joints, blocks, and internal galleries. A buttress dam consists of a number of massive concrete but-tresses that support a relatively thin concrete face or membrane, which in turn holds back the wa-ter. Many gravity and buttress dams are straight structures that cut directly across the opening that is dammed. Arch dams are arches that transfer the load of the water to the abutments by structural action. Many are curved both horizontally and vertically, and some very thin, elegant arch dams have been built. These dams require that the abutments be absolutely reliable, but, because they are so thin, they require much less concrete than gravity dams. There are also hy-brid types. In particular the thick arch or gravity arch dam acts partially as a gravity dam and partially as an arch; Hoover Dam is the best known example.



Hoover Dam (left) and Glen Canyon Dam (right) concrete gravity-arch dams on the Colorado River, Nevada and Arizona.

Embankment dams have a core or membrane that resists the flow of water. Usually this is made of soil with a high content of clay. Because the core or membrane is not strong enough to support itself, let alone the force of the water, stronger but coarser and pervious shells com-posed of compacted earth or rock support it upstream and downstream. If the shells are made of earth, the dam is an earthfill dam; if rock, it is a rockfill dam. The details of the embankment also include transitional zones between the core and shells that prevent erosion of the core, sec-tions designed to collect seepage and direct it to a safe place, and other complications that vary from site to site. The shape and placement of the water-retaining part of the structure also varies from dam to dam; most use a central core, but some dams may have concrete membranes acting as the water-retaining features on their upstream faces.

The choice among all these alternatives involves trade-offs among many considerations, some of which can never be known precisely. Some things will not be known until construction begins. Will the deposit of clay that is to become the core be large enough and of sufficient qual-ity? Will the abutments and the foundation be tight enough? Will the foundation rock masses turn out to be heavily fractured? Will some surprising geological detail be discovered once the site is uncovered -- a geological fault running down the valley floor, a zone of weak altered rock? Dealing with such imponderables requires judgment and experience. Some of the choices among types of dams reflect institutional or national style rather than purely rational decision-making. American engineers have generally avoided thin arch dams while French, Italian, and Portuguese engineers have built them wherever possible. The choices do reflect different physical circum-stances, varying costs of materials, and availability of construction skills, but aesthetic and phi-losophical factors are also at play.



Arch dams, Donnell’s Dam on the Stanislaus River, California and Montecello Dam, Putah Creek, California

Any dam must be built in a valley over whose physical conditions and geology the engi-neers have limited control. They have to ensure that water does not seep through the foundation under the dam or through the abutments around the dam. They also have to be concerned about water seeping into the natural slopes of the reservoir. The engineers have to take their site as they find it, so these concerns may require extensive remediation of the local geology. Some-times the consequences of site geology are unforeseen and difficult. In the 1930’s, Tennessee Valley Authority built a dam at Mussel Shoals on the Tennessee River at a site underlain by what geologists call karstic limestone. Limestone is a rock composed of the mineral calcite, or cal-cium carbonate, which is soluble in water. Karst formations have been extensively dissolved by groundwater, so that large soil-filled or maybe even open cavities exist. Such solution cavities are the cause of Florida’s famous sinkholes, and more to the point, of the great limestone cave systems of Kentucky. Mussel Shoals Dam at first wouldn’t hold water. The site leaked like a sieve. TVA pumped several million bags of cement grout through borings into the dam founda-tion to stop the leaks, and while the dam now holds water, it was more expensive than anyone had hoped.

Dams and their reservoirs are complicated systems. Not only does their construction re-quire the interaction of many people with different skills, it is also constrained by whatever na-ture left for the designers and builders to work with. Furthermore, dam systems change with time as chemical and geologic processes continue to operate on the dam and its environment. The organization managing a dam has to be able to integrate the insights of a very broad range of engineers and scientists. As the noted Brazilian engineer Victor de Mello once said, “The water tends to flow in the interstices between the disciplines.”



Oroville Dam, earth embankment on the Feather River, California, and the Aswan High Dam on the Nile, Egypt.

How dams fail

Engineers are horrified by failures, but they learn from them. When an airplane crashes, teams from the National Transportation Safety Board (NTSB), the airframe manufacturer, the airline, and other interested parties investigate the causes and propose ways to avoid the same failure in the future. As a result, the airplane has evolved from one of the riskiest to one of the safest ways to travel. The effectiveness of the investigations has been enhanced by the existence of the NTSB as a focus for the investigative effort and as a repository for information learned from crashes. The same clear lines of responsibility are not always present in other areas. Even in the case of airplane crashes, the courts, the interested parties and their lawyers, government agencies, intervenors, and the media can all become involved and can get in each other’s way. Thus the process may never uncover the root cause of a failure. When dams fail, there is an ad-ditional problem: the water rushing through the breach obliterates much of the evidence.

In the United States several different organizations build and operate dams. The Bureau of Reclamation and the U. S. Army Corps of Engineers are the major agents for the federal gov-ernment for large dams, but other government agencies, state governments, electric utilities, and even private associations also have responsibility for dams. The largest government dam owner is the Department of Agriculture’s, Natural Resource Conservation Agency (the former Soil Conservation Service). There are over 75,000 large dams (higher than 25 feet) in the US, and by some estimates over a million dams of all sizes. Almost 60% of the large dams are privately owned. Only 3% are Federally owned. Half are more than 30 years old; a third are more than 60 years old. The National Dam Inventory Project organized by the Federal Emergency Manage-ment Agency attempts to keep track of these things.



Table 2 World’s largest dams‡ Name Country Type Meters Feet Completed 1 Rogun USSR Earth 330 1082 1985 UC 2 Nurek USSR Earth 317 1040 1985 UC 3 Grand Dixence Switzerland Concrete gravity 285 935 1962 4 Inguri USSR Concrete arch 272 892 1985 UC 5 Chicoasen Mexico Rockfill 264 866 1980 UC 6 Mica* Canada Earthfill 242 794 1973 7 Sayan-Shushen USSR Concrete arch 242 794 1980 UC 8 Mauvoisin Switzerland Concrete arch 237 777 1957 9 Chivor Colombia Rockfill 237 776 1975 10 Oroville US (Calif) Earthfill 236 770 1968 11 Chirkey USSR Concrete gravity 233 758 1975 12 Bhakra India Concrete gravity 226 741 1963 13 El Cajon Honduras Concrete arch 226 741 1984 UC 14 Hoover US (Ariz/Nev) Concrete gravity-arch 221 726 1936 15 Contra Switzerland Concrete arch 220 722 1965 16 Mratinje Yugoslavia Concrete arch 220 722 1976 17 Dworshak USA (Idaho) Concrete gravity 219 717 1972 18 Glen Canyon USA (Ariz) Concrete arch 216 710 1964 19 Toktogul USSR Concrete arch 215 705 1968 20 Daniel Johnson Canada Multiple arch 214 702 1968

The regulatory situation is correspondingly complex. Other countries have their own administrative arrangements. Despite the difficulties, the International Commission on Large Dams (ICOLD) and its American component, the United States Committee on Large Dams (US-COLD), have devoted a great deal of attention to compiling information on dam failures and their causes. These are voluntary professional societies, but almost all major dam-building agen-cies and engineers participate in their activities. Environmentalist-leaning non-governmental organizations (the so-called, green NGO’s) view ICOLD as trade group of dam owners. From the efforts of ICOLD and USCOLD and from the information generated by organizations exam-ining their own operations, engineers have developed a fairly clear picture of the causes of dam failures. The raw data for this insight are contained in a somewhat intimidating volume called, The ICOLD Inventory of Dam Failures and Incidents. A failure is defined as an event in which containment of the pool is lost, and water rushes through, over, or around the dam on its way downstream. Incidents are events that might have become failures, but for the intervention of quick-thinking operators or good fortune. Dam engineers are mostly plain-spoken sorts, and of-ten surprisingly humble about what they know and don’t know about nature. They call failures what they are, rather than wrapping such catastrophes in public relations terms such as “adverse behavior,” “unanticipated outcome,” “negative reserve margin,” or any of the other evasions ut-tered too frequently by officials hoping to shed blame.

The foremost cause of failure is overtopping. This is another way of saying that more water has flowed into the reservoir than the reservoir can hold. The excess water has to go somewhere, and the most likely place is over the top of the dam. This does serious damage to the dam, especially to an embankment dam, which is likely to erode away. Any child building a

‡ Should update for post 1973 dams that may be higher, and check completion dates or UC dams. * Wasn’t Mica renamed Terzaghi????



small embankment across a rivulet observes what happens when the water rises too high behind the dam. To prevent overtopping, engineers provide spillways or outlet works to release the ex-cess water in a controlled manner. These can run through, over, or around the dam, and gates are designed to control the release of water. At some dams, even when the outlet gates are fully open, the spillways are not large enough to carry the water piling up behind the dam. Such cases are described as having “inadequate spillway capacity.” Overtopping and inadequate spillway capacity tend to be lumped together in the catalogues of dam failures. The accompanying table lists modern dam failures and their probable cause.

Table 3 Dam failures and causes† Dam Country Type Built Failed Fatalities Probable cause of failure Alla Sella Zerbino Dam

Italy Concrete grav-ity

1923 1935 100 Structural collapse

Austin Dam US (Penn) Concrete grav-ity

1910 1911 80 Weakness between dam and founda-tion

Babii Yar Dam Ukraine Earthfill 1961 145 Overtopping (wave action) Baldwin Hills Dam US (Calif) Earthfill 1951 1963 0? Fault displacement leading to crack-

ing Bila Desna Dam Czechoslova-

kia Earthfill 1915 1916 65 Piping

Bouzey Dam France Masonry 1895 Structural collapse Bradfield Dam England Rockfill 1859 1864 238 Piping Buffalo Creek Dam US (W.Virgina) Tailings (not

engineered) 1960 1972 125 Overtopping

Canyon Lake Dam US (N.Dakota) Earthfill 1972 2423 Overtopping Dnjeprostroj Dam USSR Concrete grav-

ity 1941 Sabotaged in war

Eder Dam Germany Concrete grav-ity

1914 1943 Air bombing

Eigiau and Coedty Dams

Wales Concrete grav-ity

1913 1925 16 Piping in foundation at Eigiau leading to overtopping of Coedty downstream

El Habra Algeria Rubble-masonry

1872 1881 209 Structural collapse

Eklutna 1951 Fontenelle Dam4 US (Wyoming) Earthfill 1964 1965 N/A Piping Fred Burr 1947 Frenchman Creek US (Montana) 1952 Frías Dam Argentina Rockfill 1940 1970 102 Overtopping Gleno Dam Italy Concrete arch 1923 1923 600 Structural collapse Hyokiri Dam S. Korea 1961 127 Overtopping? Khadakwasla (Poona) Dam

India Masonry 1879 1961 Ukn Overtopping

Little Deer Creek US (Utah) 1962 Lower Otay Dam US (Calif) Rockfill 1897 1916 30 Overtopping Machhu II Dam India Masonry-

Earthfill 1972 1979 1300 Overtopping

Malpasset Dam France Concrete thin arch

1954 1959 421 Abutment failure

Mill River Dam US (Mass) Earthfill (not engineered)

1865 1874 143 Piping

† Should review past 20 years of ENR for other, more recent failures 3 Canyon Lake Dam failure was only part of the larger tragedy of flooding in Rapid City, ND on June 9, 1972. The death toll is due to the entire flood. 4 Fontenelle Dam did not fail, in the sense of lose of containment of the pool. Quick action by Bureau of Reclama-tion operations crews narrowly averted failure by rapidly drawing down the water level behind the dam.



Möhne Dam Germany Concrete grav-ity

1913 1943 1200 Allied bombing

Nanaksagar Dam India Earthfill 1962 1967 100 Piping Orós Dam Brazil Earthfill 1960 1960 Ukn

(>1000?) Overtopped during construction

Panshet India Earthfill 1961 1961 Ukn Outlet works failed during construc-tion

Puentes Dam Spain Masonry 1791 1802 600 Piping of subsurface St Francis US (Calif) Concrete grav-

ity arch 1926 1928 450 Abutment failure either by piping or

excess cleft water pressure Sempor Dam Java Rockfill 1967 1967 Ukn Overtopping during construction Sheep Creek 1969 1970 South Fork (Johns-town) Dam

US (Penn) Earthfill 1839 1889 2209 Spillway inadequacy leading to over-topping

Steva Dam ???? Italy 1885 Stockton Creek 1949 Teton Dam US (Idaho) Earthfill 1975 1976 11 Piping Tigra Dam India Concrete grav-

ity 1917 1917 Ukn Scour

Vaiont Dam Italy Concrete thin arch

1960 1963 2600 Reservoir slope slide

Valparaíso Dam Chile Earthfill 1888 100 Ukn Van Norman (San Fernando) Dam5

US (Calif) Earthfill 1930 1971 N/A Seismic liquefaction

Vega de Tera Dam Spain Buttress 1957 1959 144 Structural collapse Walnut Grove Dam US (Arizona) Earthfill 1890 Ukn Overtopping Walter Bouldin Dam US (Alabama) Earthfill 1967 1975 0 Piping Watershed 3 1962 Watershed 16 1960 Wesley E. Seale 1958 Wheatland 1 1960 Whitewater Brook Upper

1943 1972

Zgorigrad Dam Bulgaria Earthfill 1966 96-600 Overtopping caused by failure of tail-ings dam upstream

Establishing the necessary size of the spillway and outlet works is a major design deci-sion that has to be based on the anticipated patterns of water flow. The way the reservoir system is operated is equally important. Organizations that operate dams develop manuals to instruct the local operators what to do in various situations, and they usually assume that the operators know the procedures and will follow them. It has happened that the operating procedures and the design of some outlet works did not contemplate the volume of flow that actually developed, but some failures happened because the operators did not follow the prescribed procedures. An example is the Euclides da Cunha dam in Brazil. In 1977, during a torrential rainstorm, the wa-ter in the reservoir rose faster than the rate at which the spillway gates were supposed to be opened. However, the operators were reluctant to open the gates because the resulting flood would damage their friends, relations, and property downstream. They waited too long to open the gates; the result was a major dam failure and far more loss of life and property.

Table 4 Cause of dam failure (%) Mechanism of failure Gruner (1967) Middlebrooks (1953) Takase (1967) USCOLD (1973) Babb and Mermel

(1968)

5 Lower San Fernando Dam (Van Norman was the name given to the reservoirs behind the Upper and Lower San Fernando Dams) did not actually fail, although if the pool level had been only a few feet higher, it would have.



Overtopping or inade-quate spillway

23 30 28 38 36

Piping or seepage 40 38 44 44 30 Slides 2 15 10 9 15 Miscellaneous 35 17 18 9 19

The second major cause of failure is internal erosion or piping. This phenomenon starts when the velocity of the water seeping through an embankment or abutment becomes so large that it starts to pick up some of the particles of the soil. Once the particles are removed, the channel is larger. It then attracts more flow, which picks up more particles and enlarges the channel further. The end of this process can be a channel or pipe (hence the term “piping”) so large that the flow through it destroys the dam or abutment. On June 5, 1976, the Bureau of Rec-lamation’s 300 foot-high Teton Dam failed. The dam had only recently been completed, and the reservoir had never been filled. Unusually large snow melt in the Grand Teton mountains sent water into the reservoir more rapidly than had been anticipated, filling the reservoir to capacity. The outlet works were not yet operating, so there was no way to divert the water. Engineers are still debating whether the piping started in the embankment or in fissures in an abutment or in the foundation or at imperfections at the contact between the dam and the foundation. There is no question that the internal erosion created a full breach near the right abutment that allowed the entire contents of the reservoir to escape in a wave that engulfed the towns downstream, killed eleven people, and caused damage estimated at $2 billion.

Engineers have learned a great deal about internal erosion and the effects of seepage at dam sites. They go to great lengths to control seepage under and around dams. This can involve constructing walls to contain the seepage or pumping concrete at high pressure into the rock to seal openings. These pressurized concrete systems are called grout curtains, and current practice is to rely on three or more instead of just one. Embankments have multiple layers with different permeabilities and grain sizes, some to prevent seepage, some to channel the flow safely into drains, and some to prevent particles from migrating under seepage pressures and initiating pip-ing. To make sure that all this is working properly, engineers install devices to measure move-ments and pressures and monitor the readings regularly. A modern dam is a complicated and ever-changing structure with which the operators interact continuously.

People who deal with older dams recognize that they were not built with the same knowl-edge and experience as a modern dam. This is particularly true of dams that were built and maintained by inexperienced groups without adequate engineering support. The Johnstown flood of 1889, one of the worst public disasters in U. S. history, killed about 2200 people. It happened because a badly designed embankment dam, operated by a private club to retain water for a resort lake, and maintained poorly if at all, collapsed during a heavy rainstorm. In 1977 the Toccoa Falls Dam, built originally with volunteer labor at a religious camp, failed under similar circumstances; 39 people died in the resulting flood. This failure, following closely after the Te-ton Dam failure, generated nationwide programs to evaluate the safety of existing dams.



How safe are dams?

Dams fail in catastrophic ways that become fixed in historical memory. The Johnstown flood, now over a hundred years ago, has been the subject of many books and articles and a Pub-lic Broadcasting documentary. It has become an icon for class friction, callous disregard for human life, and the evils of capitalism. Dam failures can kill a lot of people, sometimes hun-dreds or thousands. The largest airplane crash is relatively small by comparison and seldom in-volves much property loss. The worst airplane disaster in history occurred on Tenerife on March 27, 1977 when two 747’s fully loaded with sun-chasing vacationers, crashed and burned on the runway, killing 590 people.

Dam engineers are obsessed with performance records, even if they are less impressed with the statistical analysis of those records, or indeed, with statistical analysis in general. ICOLD, and its national member organizations such as USCOLD in the US, ANCOLD in Aus-tralia-New Zealand, maintain meticulous records of any adverse incident that happens at a major dam, anywhere in the world. These are published periodically and are available to anyone who wishes them. Many dam building agencies, such as the US Bureau of Reclamation and Corps of Engineers, also keep performance records and track failures, accidents, and incidents. In the par-lance of this record keeping, a failure means catastrophic loss of pool, an accident means a se-quence of events that could have caused failure but for the mitigation of operating personnel or good fortune, and an incident means any other performance of an adverse or unanticipated na-ture.

The analysis of these records became a folk industry during the administration of Jimmy Carter. Carter entered the White House in 1977 with a well-developed animus toward the Fed-eral dam-building agencies, especially the Corps of Engineers. Carter is said to have felt when he was Governor of Georgia that the Corps was fudging the numbers in calculating cost-benefit ratios for flood control and navigation projects, thereby justifying projects to Congress that were economically insupportable and environmentally harmful, but which both Congress for home district interests and the Corps for organizational interests favored despite the economic and en-vironmental balance sheet. The Teton Dam failure was still fresh in memory, and the privately maintained Toccoa Falls dam in Georgia failed shortly after he assumed office.

As a result of Teton, the Bureau of Reclamation got very interested in dam safety very quickly. In 1980, Jansen (1980), Assistant Commissioner of the Bureau of Reclamation, and prior to that, Director of Design and Construction, published an extensive report on the history of dam failure around the world. This report is little known today, but a learned and thoughtful study. The US Water Resources Council, an executive branch agency created by Carter to deal with the water agencies, also commissioned a survey of the records, to which one of the authors contributed. These various statistical studies led to the conclusion that dams fail at a more or less predictable rate, but more importantly, that so-called modern well-constructed dams do so, too. “Modern well-constructed” was a euphemism. It meant federal dams. While the Bureau was in no position to protest, given the recent experience of Teton, the other water resource agencies, and especially the Corps of Engineers, were not happy. Civil engineers, as a general rule, do not



like dealing with statistics and probabilities. The old school has always taught that one must be prudent and conservative. No rate of failure is acceptable, and none should be planned on. The idea that a Corps dam might have a non-zero chance of failure was not a concept Corps leader-ship was keen on entertaining.

Teton Dam, Idaho failing by internal erosion on June 5, 1976. Left, initial breakout of seepage on face of dam. Middle, wave

pouring through eroded opening. Right, after wave passed through.

The reaction of the engineering community notwithstanding, the historical record sug-gests that modern, well-constructed dams do fail at a rate of about one in 10,000 per dam per year (Baecher et al. 1980). Supposing a design life of 100 years, which is a little long, this rate suggests that at least 1 dam out of 1000 will fail during its design life. That is, given that there are roughly 75,000 US dams, we should expect 5 to 10 failures a year, and that is about what we get.6 According to the Federal Emergency Management Agency (FEMA), Tropical Storm Al-berto, in July 1994, alone caused over 200 dam failures in Georgia, and nearly one-half the deaths from that storm occurred when a series of unregulated earthen dams near Americus burst, drowning 15 people. Since 1960, there have been at least 23 dam failures in the US causing fa-talities. The rate of accidents and incidents is, of course, larger.

While individual dam failures historically have caused hundreds or thousands of deaths, since mid-century, individual dam failures in the US have more typically caused a maximum of between 10 and 100 deaths (DeKay and McClelland 1993). Today, because of improved warn-ing systems and stricter inspection and monitoring rules, most dam failures in the US do not cause loss of life. Only about one dam failure every two years causes loss of life. Supposing that between 10 and 100 people die in such a failure, and given the 75,000 dams in the US, the expected loss of life for a particular dam is between 6×10-4 and 6×10-5 per year. Compared to the spectrum of other risks to life faced by American society, the risk due to dam failure is some-where in the middle, higher than risks of immediate death due to nuclear power plants, but lower

6 Using the federal guidelines of 25 feet or more high.



lower than the risk of dying in a car accident. Of course, the risk is not uniformly distributed. People who do not live in the flood plain downstream of a large dam enjoy essentially no risk at all—unless they just happen to be driving by as a dam fails.

The risk of dam failure is also not uniform in the life of the dam. Like most engineered products, the chance that a dam will fail is highest during first use, which for a dam is first-filling, the first time that the reservoir is filled to capacity. If something was overlooked, or if some adverse geological detail was not found during exploration, then this is usually the time that it will first become apparent. As a result, about half of all dam failures occur during first filling. The other half occur more or less uniformly in time during the remaining life of the dam. So, if the rate of failure averaged over the whole life of a dam is about 1/10,000 per dam-year, the rate during the first, say, five years reaches almost 1/1,000 per dam-year, or ten times higher. This is exactly what the historical record shows. Interestingly, the very first dam in the historical record, the Sadd el-Kafara, an earthfill and masonry embankment the remains of which lie about 32 km (20 mi) south of Cairo on a Wadi in the eastern desert of Pharonic Egypt, is thought to have failed by overtopping at its first filling, in about 2900 BCE (Schnitter 1980).

That about half of all dam failures occur during first filling is a troubling observation, for the following reason. In the arid western states, which tend to have wet seasons and dry seasons, and which use dams primarily for irrigation and only secondarily for flood control, reservoirs are typically kept full. If a heavy storm is forecast, the reservoir is lowered to make room for the larger inflows coming from upstream. But in the eastern states, where dams primarily serve flood control needs, and irrigation is not an important benefit, reservoirs are typically kept low. If a flood comes, either its entire flow is caught behind the dam, or if it is a very large storm, at least its peak flow is caught. But since most flood control reservoirs are designed for floods of a size that essentially never comes—what dam designers call, the probable maximum flood (PMF)—most eastern US dams have never experienced design pool levels, they have never seen first filling, and thus have never been proof tested. The probability of failure of these dams, should the extreme flood come, could be ten times greater than that of a western dam. Of course, the chance of this design flood, the PMF coming, is purposely remote.

The Probable Maximum Flood

The engineers who design dams do not like statistics and probabilities, and only reluc-tantly talk about risk. “We don’t design dams with some chance of failing,” was the comment of a prominent engineer talking about risk assessment to a recent meeting of the American Society of Civil Engineers. It has only been in the past twenty years that probability has even been taught in more than a handful of university programs in civil engineering, and probability is still only a recommended part of the civil engineering curriculum according to ABET, the Accredita-tion Board for Engineering and Technology, which accredits engineering education in the US. No, dam designers are more comfortable designing for a specific, given condition, and then plac-ing a large factor of safety on their work, just in case.

A factor of safety is the ratio of the load for which the dam is designed, compared to the load that is expected. For example, the Oroville Dam on California’s Feather River is a little



over 800 feet (247 m) high. At full pool, the water pushes on the back of the dam with a force of about 10,000 tons per lineal foot (30,000 metric tons per lineal meter). That is equivalent to the weight of 5,000 Cadillac El Dorados on each foot of the dam’s breadth. Were the dam designed to sustain a load of, say, 20,000 tons per foot, or twice that anticipated, then the factor of safety for water load would be 2. There are many factors of safety to be considered in designing a dam, because there are many different loading conditions. Designers consider factors of safety against water loads, settlements, slope instabilities, internal erosion of the core, and many other things. Typical factors of safety might range from about 1.5 for mechanisms of failure that are reasona-bly well known and specified, to 3.0 or more for those that are less so. Engineers would say that factors of safety have nothing to do with risk and probabilities; factors of safety have to do with prudence and conservatism.

In contrast to engineers, the economists and planners who need to justify public invest-ments to Congress or private investments to stockholders, have been trained at elite MBA pro-grams, where risk management is the way of the world. The best-seller status of Bernstein’s re-cent history of risk theory, Against the Gods, suggests how pervasive this view is. Even the Of-fice of Management and Budget, the watchdog for federal finance and accounting standards, has mandated risk assessment for federal investment planning, and the Congress has discovered risk-based regulatory planning as an end-run around pervasive regulations. But this is not the case among dam engineers. The tension inside agencies and corporate engineering offices is unmis-takable. The economists hold the key to project funding, and they want project decisions ex-pressed in concepts of risk. The engineers, long the dominating spirits of dam development, have to toe the line if projects are to go ahead.

This tension plays itself out, among other places, in deciding upon the “project flood:” how big a flood should the dam be designed to hold back? The answer to the engineers is: the largest flood that can be expected. The answer for the economists is: the flood that best bal-ances safety with cost.

The largest flood that can be expected is the probable maximum flood. This is “the flood that may be expected from the most severe combination of critical meteorological and hydro-logic conditions that are reasonably possible in the region,” according to what everyone in the dam industry calls, the blue book, because of its cover, and to distinguish it from its sister publi-cation, the green book. The blue book is the report of the Committee on Safety Criteria for Dams, published by the National Research Council in 1985 (1985). The green book is the report of Committee on the Safety of Existing Dams, published in 1983 (1983). The PMF is based on professional judgment about what this “most severe combination” might be and what “reasona-bly possible” means. This all begins to sound like a trial lawyer’s dream of eternal litigation. Not surprisingly, experts disagree on how to interpret these phrases, but the concept is clear. The PMF is the largest storm that can be imagined, falling on the already soggy watershed, and lead-ing to the largest amount of water flowing downstream to the reservoir. Although engineers do not readily admit it, the PMF is a flood with nearly no chance of ever happening. Building a dam to hold back the PMF is conservative; it is what engineers feel comfortable with. It is pru-dent. It is also expensive.



The way engineers calculate the PMF in practice is to look through history for the maxi-mum rainfall that has occurred in the region, or the maximum rainfall that could conceivably oc-cur in the region, and then move that rainfall directly over the tributaries of the dam. In the jar-gon, this is called the probable maximum precipitation (PMP). If the drainage includes moun-tains with winter snow, the storm is assumed to fall on a full snow pack, causing melting, and an increased amount of water. The PMP is assumed to fall at a time when the soil in the drainage basin is already saturated by previous storms, so little of the new precipitation soaks into the soil, and the maximum amount runs off into the streams feeding the reservoir. This leads to a large hypothetical flood. Although the US has more than a million dam-years of record, a PMF has never been observed at a US dam site.

The alternative way to predict extreme floods is to estimate the recurrence intervals of large floods from a statistical analysis of the historical record of rainfall and runoff. A recur-rence interval is the average period between floods. A 100-year flood is that which, on average, occurs once every 100 years. More precisely, as the engineering community defines it, the 100-year flood is that which has a probability of 1/100 of occurring in any given year. A fifty-year flood is that with a 1/50 chance of occurring in any given year, and a 1000-year flood is that with a 1/1000 probability. Contrary to most people’s intuition, the chance that a 100-year storm will occur at least once in any 100 year period is actually about 2/3, and the chance is about 1/4 that more than one 100-year flood will occur.

The problem with statistical analysis of flood frequencies is that there just have not been enough years within which floods have been measured. Hydrologists plot the historically ob-served flood heights or volumes on a graph. Along the vertical axis they plot the height or vol-ume of the peak annual flow in the river. Along the horizontal axis they plot the ranking of the flood against its frequency of not having been exceeded. For example, the smallest annual flood in 100 years of observations is plotted at 1/100, because 99 of the 100 annual floods were larger than it was. The flood in the middle is plotted at 50/100, because 50 of the 100 annual flows were larger than it was. The largest annual flood is plotted at 99/100, because all but itself were smaller. If plotted on the right type of grid paper, what statisticians call extreme value probabil-ity grid, these points lie more or less on a straight line. By extrapolating the line, estimates can be made of extreme floods which have never been observed. 200-year storms or even 1000-year storms can be estimated from 100 or fewer years of observed floods. Of course, as the line is ex-trapolated ever further, the estimate rapidly becomes less certain. Most hydrologists are com-fortable extrapolating the historical record to perhaps twice its duration, but out at 1000-year re-turn periods, few are still confident of their results.

The US is less than 250 years old as a country, and most stream records go back no more than 100 years; many go back no more than 50. So, floods with return periods longer than a few hundred years are largely guess work. The short length of record for most streams means that es-timates of floods larger than the 100-year or 200-year event can be widely in error. For example, when Oroville Dam was built, some of the most experienced hydrologists in the world, those working for the California water agencies and the Bureau of Reclamation, made forecasts of flood frequencies on the Feather River. Even so, during the 10 year construction of the dam, the



site experienced two 1000-year floods and one 10,000-year flood. While one might argue that with random processes anything is possible, any gambler at Reno who suffered such losses would have good reason to suspect the house of cheating. In reality, there just are not sufficient years of record to rule out extreme events, and as a result of the experience, the flood frequency graph for Oroville was significantly revised.

The longest record of stream heights anywhere is for the Nile, going back, intermittently, 5000 years; yet, as amazing as that fact is, even this long period of record does not allow engi-neers to approach estimating the return period of the PMF as conceived in the Federal Guidelines for Dam Safety. The Corps of Engineers position, as described in the engineering manual, Hy-drological Engineering Requirements for Reservoirs (1997), is that the return period of the PMF is not necessarily susceptible to probabilistic analysis, but rather is an estimate of the largest flood physically possible in the watershed: “The probable maximum precipitation [from which the PMF is calculated] is based on the maximum conceivable combination of unfavorable mete-orological events.” The manual goes on to say that, “while a frequency is not normally assigned [to the probable maximum precipitation], a committee of the ASCE has suggested that the PMP is perhaps equivalent to a return period of 10,000 years.” On the other hand, using the normal extrapolation methods for flood frequency analysis, and using a variety of extreme value prob-ability models, Resendez-Carillo and Lave have estimated that the PMF for one dam, the Mo-hawk Dam in Ohio, has a return period of no less than 2.2 million years. Calculating the prob-ability of this flood actually happening seems a bit meaningless.

A more difficult problem with predicting extreme floods, whether as a PMF or using sta-tistical methods, is that the world is changing. Many things are being blamed on potential changes in global climate, while at the same time our understanding of global meteorology has been expanding by leaps and bounds. El Niño and the corresponding North Atlantic Oscillation, which influences climate along the east coast of North America and in Europe, were hardly known a few years ago, and they are now relied upon to explain a whole host of curious weather phenomena. Of more immediate interest for flood forecasters is what is happening on the ground upstream of the nation’s dams.

Land development has a tremendous affect on floods. Cutting down forests (or reforesta-tion as in New England) dramatically changes the amount of rainfall that soaks into the soil, as do changes in agricultural practices. Building roads or shopping malls with acres of pavement causes rainfall to flow almost non-stop into the drainage network. All these things mean that for most watersheds in the US, floods are becoming more frequent and larger. A recent study of the American River at Sacramento, California by a panel of the National Research Council con-cludes that, although on a national level there is little evidence for an increase in precipitation over the last century, “there is little doubt that the observed frequency of large floods on the American River is much greater in the period from 1950 to the present than it was in the period from 1905 to 1950” (National Research Council (US) 1995) The panel concludes that it is not possible today to know whether this change is due to climate or due to anthropogenic factors, but the last 50 years have seen profound land use changes and development in the Sierra foothills in which the American River rises.. Changes such as those on the American River have caused the



federal dam building agencies and the US Geological Survey to revise upward the PMF for many existing dams, both public and private. The Corps and Bureau have sought funding from a reluc-tant Congress to retrofit existing dams by increasing spillway capacity or raising heights, and the Federal Energy Regulatory Commission has demanded that privately owned dams meet the new criterion. The retrofit for just one such dam subject to an increased estimate of PMF, Bluestone Dam in West Virginia, carries a price tag of $60 million, and no one knows whether the new PMF is an economically reasonable criterion for dam safety.

If dams are designed to hold the PMF, and if the PMF is so large and rare that it never happens, why are almost one-third of dam failures caused by overtopping? There seem to be three reasons. First, many occur during construction, before spillways, gates, and other works are complete. Although not cataloged as an overtopping failure, this is exactly the situation that occurred at Teton Dam, where the spillway structure was incomplete and so could not be opened to lower the pool when seepage was observed on the downstream face of the dam. Second, many of the overtopping failures occur at tailings dams or other structures that either never bene-fited from modern engineering practice or were poorly maintained. This was the situation at Buffalo Creek, South Fork (Johnstown), and Zgorigrad. Third, many overtopping failures occur at dams that were built long ago, and therefore had inadequate spillway capacity to pass what to-day would be a design flood. This was the case at Lower Otay, Walnut Grove, and Frías.

What really happened at St Francis and Vaiont?

When the St. Francis Dam failed, the rushing water eliminated much of the evidence needed to establish how the failure occurred. Furthermore, William Mulholland took public re-sponsibility for the failure, so the demand to establish culpability was partially mitigated. The responsible party had been found; why search further for explanations? Though public investi-gations of failures are unpleasant for all involved and may mistakenly identify scapegoats, they do sometimes uncover underlying causes. In the St. Francis Dam case the investigations con-cluded that the immediate cause of the failure was that the rocks in the right abutment (the Sespe red beds) fell apart when submerged in water. The process, called slaking, happens with many rocks whose components are mere pressed together rather than cemented. The dirty seepage ob-served the day before the failure could be attributed to the slaking of the rocks in the right abut-ment. Once the right abutment rocks had slaked, there would be nothing to support the dam, and it would fail. This mechanism was so plausible and the potential of the rock at the right abut-ment to slake was so demonstrable, that further investigation of the failure seemed gratuitous.

Recently, J. David Rogers (1995), an engineering geologist practicing in California, has re-examined the records of the St. Francis Dam failure. He concludes that the failure actually started at the left abutment. He shows that the left abutment was composed of the debris of a massive pre-historic landslide that had dammed the river and then been cut through by the river. When the water rose in the reservoir it entered the slide debris, and the resulting uplift pressures reactivated the ancient landslide. The enormous mass of the slide pushed on the left end of the dam, forcing it to bend and crack. The pressure of the water in the reservoir then destroyed the cracked dam. Rogers’ arguments are based on geological investigations, mechanical analyses of



the sliding mechanisms, detailed studies of where the various parts of the dam came to rest, and reconsideration of the limited eyewitness testimony. He also states that the slaking of the Sespe beds, inadequate design to deal with the uplift pressure of the water percolating under the dam, and less-than-expected width of the base of the dam contributed to the failure. To this day the received truth about the failure is that it was caused by the slaking of the rocks at the right abut-ment, but we find Rogers’ reconstruction convincing. Even though the investigation did not identify Rogers’ mode of failure, it is doubtful that the analytical tools available at the time would have been able to deal with it. Rogers observes, “Uplift forces acting to destabilize the sloping abutments would appear to have been similar to those which fostered the disastrous fail-ure of Malpasset arch dam in France in 1959, which took more than five years to sort out and understand.” Had the St. Francis Dam investigations identified this mechanism, would the fail-ure of Malpasset dam have been prevented?

The investigations in the aftermath of the St. Francis Dam failure did identify several im-portant administrative and regulatory issues. California mandated review of all but federally sponsored dams and reservoirs in the state and established the world’s first agency devoted ex-clusively to the safety of dams. The Los Angeles Department of Water and Power reassessed all its dams and reservoirs and did extensive retrofits on some of them. The state mandated the first version of procedures for arbitrating wrongful death suits.

The Board of Inquiry and the Coroner’s Inquest both recommended that major dam pro-jects should not rely on one person’s judgment and should be subject to review by outside pan-els. Many public and private agencies followed this advice in subsequent years, and it became common for major dam projects to set up panels of experts to review design and construction. Review panels also were formed for other major projects; sometimes there were several panels for different aspects of the project. However, some agencies resisted using outside review pan-els, and the Idaho Teton Dam Inquiry Board had to make almost the identical recommendation a half century later (Rogers, 1995).

At Vaiont the left side of the reservoir slid into the reservoir. The tasks facing the inves-tigators was to determine precisely the geologic strata along which the slide occurred, to develop a credible mechanism for the slide, and to relate these to the history of the reservoir in the years before the slide. Many experts studied the problem and disagreed over the mechanics of the slide. A particular problem was that episodes of sliding seemed to be related to the level of wa-ter in the reservoir and to the rainfall, but it was not clear how this relation worked.

Hendron and Patton (1986) established from field studies at the site that the slide had oc-curred along a layer of very plastic clay with low frictional resistance. The sliding mass was what remained of an ancient landslide. Geotechnical engineers recognize that frictional resis-tance in such a situation is governed by the effective stress, which is the pressure from the over-lying material minus the pressure of water in the pores of the soil. If the pore water pressure rises, the effective stress drops, and the soil has less frictional resistance. Hendron and Patton then examined the history of both rainfall and reservoir level. When the level of water in the reservoir rises or when there is significant rainfall, the pore water pressure rises, and the effective



stress drops. The accompanying figure from Hendron and Patton’s paper, gives the history of water level, rainfall, and slope movement. The horizontal axis is precipitation, in millimeters, for the preceding 30-day period. The vertical axis is the elevation of the water in the reservoir, in meters. Each point represents an observation, with the corresponding date written next to it. Triangles represent conditions with no observed movement, and open circles stand for cases with movement less than 0.5 centimeters per day. Points that are half-black and half-white corre-spond to observed motions between 0.5 and 0.99 centimeters per day. Solid black points indicate movements in excess of 1 centimeter per day. The black points and the half-black points are clearly in a different region than the open points. A line separating them is labeled the failure envelope. Conditions in the shaded area lead to large movements and eventual failure. Previous investigators had tried to tie the movement to the water level or the rainfall but not to both; the movements are actually related to both. Hendron and Patton analyzed the slope with the low frictional coefficients for the clay and showed that the onset of serious movement was predict-able if the analysis incorporated both contributions to the pore water pressure. This was a wel-come development, for engineers dealing with similar slopes need to have analytical tools that work for actual slides.

The experience at Vaiont and St. Francis reinforces the importance of recognizing geo-logic formations that are actually the debris of ancient landslides. This is not an easy task. Such debris can be very large and can be hard to distinguish from a formation that is in place. The events also highlight the importance of detailed understanding of the geological conditions. They also demonstrate that detailed investigations using modern analytical tools and careful field observations are necessary to establish the actual mechanism of a failure.

Lessons

The history of dam failures reveals that failures are rare but that they are costly in lives and property. Dams and reservoirs are complicated systems that require the attention of persons versed in several disciplines. However, they are also often the product of an organization pos-sessed of vision and determination, and it is difficult to change the direction of such an organiza-tion. Therefore, outside reviews are essential to reduce the opportunities for the organization to head off in the wrong direction.

Failures often occur in organizations that have convinced themselves that failure is unlikely and that the existing procedures are adequate to prevent it. Friendly skeptics here pro-vide valuable insurance against overconfidence. No one enjoys having his or her work reviewed by an outsider, but such review is one of the best ways to guard against error, whether in scien-tific research or dam construction.

Although the actual release of water may occur quickly in a dam failure, the events lead-ing up to the failure usually take place over an extended time. The south slope of the Vaiont res-ervoir was studied for nearly three years before it failure catastrophically. The problems at Te-ton Dam were evident almost from the moment construction started, and the failure itself oc-curred slowly enough that a tourist captured it on his movie camera. Could anything have been done to prevent the failures? In retrospect, lowering the water level in the Vaiont reservoir or not



Failure and non-failure conditions for Vaiont reservoir slope (from

Hendron and Patton, 1985)

filling it until the mechanisms of the slide were understood, ensuring that the outlet structures at Teton Dam were working before filling the reservoir, or following the operating instructions to open the spillway at Euclides da Cunha would have prevented a great deal of damage and grief. However, people caught up in the stress of events seldom make the right decisions.

When faced with the statistics of failure and the suggestion that risk be confronted when a project is being planned, organizations are often reluctant. If people think a new dam might fail and that some chance of failure can be calculated, the argument goes, then they begin to think that a chance of failure is acceptable and stop being conservative enough in design. Sec-ond, failures are things that happen to other people’s dams. Our organization has put in place procedures and policies that prevent failures from taking place. We’ve taken care of failures.

The first point indeed has merit. People work on one dam at a time, not many dams. While statistics govern how things come out, statistics do not apply to what the individual de-signer does day by day. It’s much the same with drivers. There are inherent statistics about car accidents, but it is prudent to be as safe as possible because you’re dealing not with statistical failure but with your particular car and your particular safety. Organizations put in place a de-



sign environment to make people think about their dam as the only one, and that things must be done right. There will be no second, statistical chance.

References

1. Babb, A. O., and Mermel, T. W. (1968). “Catalog of dam disasters, failures, and accidents.” NTIS PB179243, U.S. Bureau of Reclamation, Springfield, VA.

2. Baecher, G. B., Pate, M. E., and deNeufville, R. (1980). “Risk of dam failure in benefit-cost analysis.” Water Resources Research, 16(3), 449-456.

3. DeKay, M. L., and McClelland, G. H. (1993). “Predicting Loss of Life in Cases of Dam Fail-ure and Flash Flood.” Risk Analysis, 13(2), 193-205.

4. Gruner, E. C. (1967). “The safety of reservoirs.” World Dams Today (Japan Dam Associa-tion), 104-109.

5. Hendron, A. J., and Patton, F. D. (1985). “The Vaiont Slide: A Geotechnical Analysis Based on New Geologic Observations of the Failure Surface.” , , U. S. Army Corps of Engineers, Waterways Experiment Station.

6. International Commission on Large Dams. (1973). Lessons from dam incidents, C.I.G.B., Paris.

7. Jansen, R. B. (1980). Dams and public safety, U.S. Dept. of the Interior Water and Power Resources Service, Denver, Colo.

8. Middlebrooks, T. A. (1953). “Earth-dam practice in the United States.” Transactions of the American Society of Civil Engineers, Centennial Volume, 697-721.

9. National Research Council (U.S.). (1983). Safety of existing dams : evaluation and improve-ment, National Academy Press, Washington, D.C.

10. National Research Council (U.S.). (1985). Safety of dams : flood and earthquake criteria, National Academy Press, Washington, D.C.

11. National Research Council (US). (1995). Flood Risk Management and the American River Basin: An Evaluation, NRC Press, Washington, DC.

12. Rogers, J. D. (1992). Reassessment of the St. Francis Dam failure, Rogers/Pacific Inc., Pleasant Hill.

13. Schnitter, N. (1980). Swiss bibliography on storage dams, Comité national suisse des grands barrages, Zürich.




14. Takase, K. “Statistic study on failure, damage and deterioration of earth dams in Japan.” Ninth ICOLD Congress, 1-19.

15. US Army Corps of Engineers. (1997). “Hydrologic Engineering Requirements for Reser-voirs.” EM 1120-2-1420, US Army Corps of Engineers, Washington, DC.

dam failure - ceae.colorado.educeae.colorado.edu/~amadei/cven3698/pdf/damfailure.pdf · st. francis...

Documents